chore(review): sync acceptance safeguards

skills/revloop/SKILL.md

@@ -86,19 +86,21 @@ Examples:
 6. Implement the active unit. Run its relevant tests, lint, type checks, build, coverage, and every acceptance proof. Record unavailable verification honestly.
 7. Stage only task-owned files and create one conventional commit for the verified checkpoint.
 8. Push the checkpoint, create or resolve its draft pull request, and immediately set its living status to `Review pending`.
-9. Start a fresh primary reviewer for the exact pushed checkpoint. If it fails, invoke the fallback with the same brief without asking the user.
+9. Record the exact pushed checkpoint as `reviewed_head`, then start a fresh primary reviewer for that checkpoint. If it fails, invoke the fallback with the same brief without asking the user.
 10. Publish both gate results and the new history row before validating or fixing findings.
 11. Independently validate every finding. Fix only valid findings in the earliest work unit that owns the defect, verify again, and create a separate `fix:` commit.
 12. Push the fix, return every affected comment to `Review pending`, propagate changed parents through published descendants without rewriting history, and re-review every affected unit.
 13. For a stack, run manifest proof and a final cumulative review from the top head after all children are accepted.
-14. Set the comment to `Final verification`, rerun every required check, confirm the worktree is clean, and verify each accepted SHA equals its remote head. Mark unchanged pull requests ready from bottom to top. If any head changed, return it to `Review pending` and continue.
+14. Set the comment to `Final verification`, rerun every required check for each `accepted_head`, confirm the worktree is clean, verify each accepted SHA equals its local and remote pull-request head, and confirm required CI passed for that same SHA. Mark unchanged pull requests ready from bottom to top. If any head changed or required check is not green, return it to `Review pending` and continue.
 
 Do not stop while a valid finding, failed gate, or unmet proof obligation remains.
 
 ## Checkpoint invariants
 
 - Review only committed and successfully pushed work.
 - Keep the local `HEAD`, pushed SHA, pull-request head, and review brief checkpoint identical.
+- Bind an accepted verdict only to the exact `reviewed_head` in its brief and record it as `accepted_head`.
+- Any later worktree change, commit, push, or pull-request head change invalidates acceptance until the new head is verified and reviewed.
 - Preserve pre-existing changes. Never stage with `git add -A`.
 - Use a task-appropriate `feat:`, `fix:`, or `chore:` commit.
 - Create a separate `fix:` commit for each review-driven pass.
@@ -110,12 +112,14 @@ Do not stop while a valid finding, failed gate, or unmet proof obligation remain
 
 Complete only when:
 
-- Both specification and engineering gates pass.
-- Every required verification passes or is explicitly reported unavailable.
+- Both specification and engineering gates pass. Their accepted verdict applies only to each exact `accepted_head`.
+- Every required local verification and required CI check passes for that same SHA. Pending, failing, unavailable, or stale-head checks are not green.
 - Each accepted checkpoint equals its remote pull-request head.
 - The worktree is clean apart from preserved pre-existing changes.
 - Every pull request is ready for human review.
 
+If a check is unavailable, classify it as not required with concrete evidence or do not complete. Never claim completion after reviewer failure, malformed output, or a missing machine verdict.
+
 Report the pull request or ordered stack links, final verification, and any explicit limitations. Do not publish the raw request, review brief, internal prompt, or orchestration history outside the neutral living status comment.
 
 ## Validate this skill

skills/revloop/references/github-publication.md

@@ -192,6 +192,8 @@ The PR changed after the last accepted review.
 
 ## Final readiness
 
-Before publishing `Ready for human review`, compare the full accepted SHA with the remote head. Re-fetch the remote head after updating the comment. If it changed, immediately return the comment to `Review pending` and continue.
+Before publishing `Ready for human review`, compare the full `accepted_head` with the local head and remote pull-request head. Confirm every required CI check is attached to and passed for that same SHA. Pending, failing, unavailable, or stale-head checks are not green.
+
+Re-fetch the remote head after updating the comment. If the head changed or a required check is not green, immediately return the comment to `Review pending` and continue verification and review.
 
 Run `gh pr ready "$PR_URL"` only after the comment and final verification are current. Verify the pull request is no longer draft.

skills/revloop/references/review-contract.md

@@ -159,6 +159,8 @@ Use `VERDICT: REJECT` for any failed gate, `minor fixes`, or `needs rework`. Lis
 
 ## Process the result
 
+- Bind a valid `ACCEPT` only to the exact pushed checkpoint SHA named in the brief. Record that SHA as `accepted_head`.
+- Any later worktree change, commit, push, or pull-request head change invalidates the accepted verdict and requires verification plus a fresh review of the new head.
 - Treat an otherwise valid `ACCEPT` with a missing gate, missing engineering row, failed obligation, unjustified `N/A`, concrete finding, or non-ship verdict as `REJECT`.
 - Treat command failure, malformed output, timeout, or missing machine verdict as reviewer failure and use the fallback route.
 - Publish `Review unavailable` only after both reviewer routes fail.

skills/revloop/scripts/test-static.sh

@@ -60,11 +60,18 @@ require_file_text "$SKILL_FILE" 'references/github-publication.md'
 require_file_text "$SKILL_FILE" 'references/reviewer-adapters.md'
 require_file_text "$SKILL_FILE" 'references/stacked-pull-requests.md'
 require_file_text "$SKILL_FILE" 'Both specification and engineering gates pass.'
+require_file_text "$SKILL_FILE" "Record the exact pushed checkpoint as \`reviewed_head\`"
+require_file_text "$SKILL_FILE" "record it as \`accepted_head\`"
+require_file_text "$SKILL_FILE" 'Any later worktree change, commit, push, or pull-request head change invalidates acceptance'
+require_file_text "$SKILL_FILE" 'Pending, failing, unavailable, or stale-head checks are not green.'
+require_file_text "$SKILL_FILE" 'Never claim completion after reviewer failure, malformed output, or a missing machine verdict.'
 require_file_text "$OPENAI_FILE" 'allow_implicit_invocation: false'
 require_file_text "$OPENAI_FILE" "Use \$revloop"
 
 require_file_text "$REVIEW_FILE" 'Specification gate: PASS'
 require_file_text "$REVIEW_FILE" 'Engineering gate: PASS'
+require_file_text "$REVIEW_FILE" "Record that SHA as \`accepted_head\`."
+require_file_text "$REVIEW_FILE" 'invalidates the accepted verdict'
 for check in 'Correctness' 'Test quality' 'Maintainability' 'Architecture boundaries' 'Simplicity' 'Security' 'Operational safety'; do
   require_file_text "$REVIEW_FILE" "- $check: <PASS|FAIL|N/A>"
 done
@@ -73,6 +80,8 @@ require_text_count "$GITHUB_FILE" '<!-- pr-review-status -->' 2
 require_text_count "$GITHUB_FILE" '<!-- revloop-status -->' 1
 require_file_text "$GITHUB_FILE" '## Review status'
 require_file_text "$GITHUB_FILE" '### Quality gates'
+require_file_text "$GITHUB_FILE" "compare the full \`accepted_head\` with the local head and remote pull-request head"
+require_file_text "$GITHUB_FILE" 'Pending, failing, unavailable, or stale-head checks are not green.'
 require_file_text "$GITHUB_FILE" "Never expose the workflow name \`Revloop\`"
 reject_file_text "$GITHUB_FILE" '## Revloop'